Apparel giant VF Corporation's e-commerce deliveries impacted by a major cyber attack

American apparel and footwear giant VF Corporation said it experienced a cyber security incident that disrupted daily operations and caused delays in the fulfillment of orders.

Founded in 1899 and presently based in Denver, Colorado, VF Corporation, formerly known as Vanity Fair Mills, is the owner of several renowned apparel brands such as Vans, Wrangler, Supreme, and The North Face. The company employs about 35,000 people globally and earned a revenue of $11.6 billion in the financial year 2022-23.

In a recent filing with the U.S. Securities and Exchange Commission, the company said it detected unauthorised activities in certain parts of its internal network on 13th December. 

 

The company said it immediately launched an internal investigation, with assistance from third party cyber security experts, to understand the nature and scope of the incident and took steps to contain and remediate the incident.

“The threat actor disrupted the Company’s business operations by encrypting some IT systems, and stole data from the Company, including personal data,” VF Corp. said in its filing with the federal regulator.

It said the incident has affected its ability to fulfil retail and brand e-commerce orders just before the holiday season. While consumers across all brands can place their orders, it is not clear when the orders will be delivered to them.

“The Company is working to bring the impacted portions of its IT systems back online and implement workarounds for certain offline operations with the aim of reducing disruption to its ability to serve its retail and brand e-commerce consumers and wholesale customers,” it said.

“VF-operated retail stores globally are open, and consumers can purchase available merchandise, but VF is experiencing certain operational disruptions. Consumers are able to place orders on most of the brand e-commerce sites globally, however, the Company’s ability to fulfill orders is currently impacted.”

The company has stressed on the fact that it is working diligently with external cyber security experts to get all of its systems back online and regain the ability to serve its customers. While “full scope, nature and impact of the incident are not yet known”, the fact that hackers encrypted certain IT systems indicates that the company suffered a ransomware incident.

“As of the date of this filing, the incident has had and is reasonably likely to continue to have a material impact on the Company’s business operations until recovery efforts are completed. The Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations,” VF Corporation added.

The company is yet to share details on who is behind the cyber attack, how the threat actors infiltrated its systems or the number of individuals affected by the incident.

Last year, The North Face, one of VF Corporation’s leading apparel brands, suffered a massive credential stuffing attack that compromised the sensitive personal information of its customers.

In a notification sent to customers, The North Face confirmed that on August 11, it identified unusual activity on its website and immediately launched an investigation to determine the nature of the cyber attack. It later determined that the threat actors carried out a large-scale credential stuffing attack on its website between July 26 and August 19, 2022.